Security at MivoChat

The application runs on Vercel, with serverless functions in Frankfurt, Germany. The database, sign-in and file storage run on Supabase in Frankfurt, EU. Other processing locations are listed on our subprocessors page.

Browser and API connections use HTTPS. Hosting and database providers describe encryption at rest as part of their infrastructure services. MivoChat additionally encrypts connected integration tokens and bot tokens using AES-256-GCM; the encryption key is held in server configuration.

Database tables use row-level security policies to scope access to users and their workspaces. Server-side code uses privileged service credentials for operations that require them; those credentials are not sent to browsers. Workspace roles control what members can do, with owner, admin and member roles.

AI replies use the visitor's message and relevant knowledge text from pages you connect or text you add. MivoChat does not use customer data to train AI models. Relevant message and website text is sent to Anthropic and, when semantic search is enabled, Voyage AI. See the full subprocessor list.

The widget checks requests against the website origins configured for each site. Widget endpoints also apply rate limits to reduce bursts of abusive traffic.

Our infrastructure providers (e.g. Supabase and Vercel) maintain their own SOC 2 reports. Those reports apply to the providers, not to MivoChat.

MivoChat does not currently hold SOC 2 or ISO 27001 certification.

Please email hello@mivochat.app with a description and steps to reproduce. Please avoid including real customer data.

Related documents: DPA, Privacy, and Subprocessors.